SharkLoader DLL Drop into AppData xwreg or xgdf via SystemSettings Sideload
Detects file creation and execution patterns associated with SharkLoader malware. The rule monitors for the staging of malicious DLLs, encrypted beacon payloads, and API hooks in specific AppData subdirectories ('xwreg' and 'xgdf'), as well as the execution of 'SystemSettings.exe' from non-standard locations, which mimics legitimate Windows system processes to achieve persistence and evasion.
Splunk (SPL)
